thorcbain[.]org

This domain, thorcbain.org, is identified as a phishing portal specifically targeting users of the THORChain cryptocurrency platform. Analysis indicates the site mimics the legitimate THORChain interface to deceive victims into entering sensitive credentials, such as wallet private keys or recovery phrases. The threat primarily involves credential theft, which could lead to unauthorized access and financial loss for affected users. The page title, THORChain, directly aligns with the legitimate platform, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple technical indicators supporting its malicious nature. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with suspicious domains. It resolves to the IP address 188.114.96.3 and is flagged by 5 out of 95 security vendors on VirusTotal. Additionally, the domain appears on one security blocklist and has a trust score of 0/100. The use of Cloudflare services, including HTTP/3 and Browser Insights, suggests an attempt to obfuscate its true origin and evade detection. Users who have visited thorcbain.org or entered credentials on the site should take immediate action to mitigate potential risks. First, revoke any permissions granted to unknown applications or browser extensions linked to the domain. Next, transfer assets from any compromised wallets to a new, secure wallet and monitor accounts for unauthorized transactions. It is also recommended to scan local devices for malware, as phishing sites may deploy additional payloads. Finally, report the incident to relevant security teams or platforms to aid in broader threat intelligence efforts.